Description
Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn’t contain the dataType option.
Recommendation
Update the jquery package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.12.3, < 3.0.0 < 1.12.2** Patched version(s): **3.0.0 1.12.2**
References
- GHSA-rmxg-73gg-4p98
- access.redhat.com
- ics-cert.us-cert.gov
- kb.pulsesecure.net
- lists.apache.org
- seclists.org
- security.netapp.com
- snyk.io
- sw.aveva.com
- www.oracle.com
- www.tenable.com
- lists.opensuse.org
- packetstormsecurity.com
- security.snyk.io
- web.archive.org
- CVE-2015-9251
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Denial of Service in jquery - CVE-2016-10707
- @rpldy/uploader prototype pollution - CVE-2024-57082
- DocsGPT Allows Remote Code Execution - CVE-2025-0868
- Potential XSS vulnerability in jQuery - CVE-2020-11023
- Tags:
- npm
- jquery
Anything's wrong? Let us know Last updated on September 25, 2023